CISM practice questions 571–580

1. Question 571 · 1243 in bank

   An organization has purchased an Internet sales company to extend the sales department. The information security manager's FIRST step to ensure the security policy framework encompasses the new business model is to:

   • Aperform a gap analysis.
   • Bimplement both companies' policies separately.
   • Cmerge both companies' policies.
   • Dperform a vulnerability assessment.

   Show answer

   Answer: A

   Explanation

   Performing a gap analysis is the first step in identifying any discrepancies or deficiencies in the current security policy framework, as well as determining any additional measures that may be necessary to ensure the security of the new business model. By comparing the existing security policies with the requirements of the new business model, the information security manager can identify any gaps or areas of non-compliance, and take steps to address them before the new business model is implemented. This will help to ensure that the overall security of the organization is not compromised by the new business model.

   Source: Adapted from community discussion — Broesweelies

   Next question

2. Question 572 · 1243 in bank

   Relationships between critical systems are BEST understood by:

   • Aperforming a business impact analysis (BIA).
   • Bdeveloping a system classification scheme.
   • Cevaluating key performance indicators (KPIs).
   • Devaluating the recovery time objectives (RTOs).

   Show answer

   Answer: A

   Explanation

   The keyword is 'between' system. The BIA is a decomposition of critical business processes. The process describes interactions between systems in order to accomplish its goal. Thus why (A) is the answer. Rationale: B. Isn't the answer cause it classifies a single system. C. KPI shows trends, but not the interaction between systems. D. RTO states a time to be achieved, but not interaction between systems.

   Source: Adapted from community discussion — dark_3k03r

   Next question

3. Question 573 · 1243 in bank

   Determining the risk for a particular threat/vulnerability pair before controls are applied can be expressed as:

   • Athe likelihood of a given threat attempting to exploit a vulnerability.
   • Bthe magnitude of the impact, should a threat exploit a vulnerability.
   • Ca function of the cost and effectiveness of controls over a vulnerability.
   • Da function of the likelihood and impact, should a threat exploit a vulnerability.

   Show answer

   Answer: D

   Explanation

   Determining the risk for a particular threat/vulnerability pair is a function of the likelihood and impact of the threat exploiting the vulnerability. The likelihood of a given threat attempting to exploit a vulnerability is an important factor in assessing the risk, as it determines the probability that the vulnerability will be exploited. The magnitude of the impact, should a threat exploit a vulnerability, is also an important factor, as it determines the potential harm or damage that could result from the exploitation of the vulnerability. Together, the likelihood and impact of a threat exploiting a vulnerability provide a comprehensive understanding of the risk associated with the threat/vulnerability pair. Cost and effectiveness of controls over a vulnerability is also important but it doesn't determine the risk level before controls are applied.

   Source: Adapted from community discussion — Broesweelies

   Next question

4. Question 574 · 1243 in bank

   When making decisions on prioritizing risk mitigation activities, which of the following would provide senior management with the MOST comprehensive information?

   • ARisk assessment report
   • BRisk action plan
   • CRisk register
   • DInternal audit report

   Show answer

   Answer: C

   Explanation

   C. I understand what Bro is saying below about answer A. But a risk register is to be more comprehensive then just one assessment, right? It should be way more comprehensive then a risk assessment. Two cents.

   Source: Adapted from community discussion — CarlLimps

   Next question

5. Question 575 · 1243 in bank

   What is the PRIMARY benefit of using key performance indicators (KPIs) for information security risk management?

   • ASet targets against which the organization's information security function can be evaluated.
   • BPrevent potential undesirable events from affecting information security.
   • CIdentify risk events that have already occurred from affecting information security.
   • DEstablish the process for setting organizational objectives in light of information security risk.

   Show answer

   Answer: A

   Explanation

   A. Set targets against which the organization's information security function can be evaluated. Key performance indicators (KPIs) in information security risk management primarily serve the purpose of setting targets or benchmarks against which an organization's information security function can be evaluated. KPIs provide measurable metrics and goals that help organizations assess their security posture, track progress, and make informed decisions about improving security measures. While preventing and identifying undesirable events (options B and C) are important goals of information security, the primary benefit of KPIs is to establish a framework for evaluation and continuous improvement. Option D is not directly related to the primary benefit of KPIs in information security risk management

   Source: Adapted from community discussion — oluchecpoint

   Next question

6. Question 576 · 1243 in bank

   Which of the following is the MOST important consideration when reporting on the status of information security activities?

   • AThe report is comprehensive
   • BThe report is updated on a regular basis
   • CThe report is tailored to stakeholder needs
   • DThe report structure is consistent with industry standards

   Show answer

   Answer: C

   Next question

7. Question 577 · 1243 in bank

   Which of the following is the MOST important element when developing an information security strategy?

   • AIdentifying and classifying information assets
   • BDetermining the needs of the business
   • CAligning to applicable laws and regulations
   • DDetermining the risk management methodology

   Show answer

   Answer: B

   Next question

8. Question 578 · 1243 in bank

   Which of the following has the GREATEST influence on an organization's information security strategy?

   • AIndustry security standards
   • BThe organizational structure
   • CThe organization's risk tolerance
   • DInformation security awareness

   Show answer

   Answer: C

   Explanation

   The organization's risk tolerance has the greatest influence on an organization's information security strategy. Risk tolerance is the level of risk an organization is willing to accept or tolerate in pursuit of its objectives. An organization's information security strategy should be designed to manage risks within its risk tolerance. Industry security standards, organizational structure, and information security awareness can also influence an organization's information security strategy, but risk tolerance is the most significant factor.

   Source: Adapted from community discussion — Abhey

   Next question

9. Question 579 · 1243 in bank

   Which of the following is the MOST effective way to demonstrate alignment of information security strategy with business objectives?

   • ABalanced scorecard
   • BBenchmarking
   • CHeat map
   • DRisk matrix

   Show answer

   Answer: A

   Explanation

   "Another aspect of determining the strategic alignment is to review the business balanced scorecard. A business scorecard contains important metrics from a business perspective. It helps to determine the alignment of security goals with business goals." -CISM Exam Prep Guide, 2nd ed.

   Source: Adapted from community discussion — AlexJacobson

   Next question

10. Question 580 · 1243 in bank

    When management changes the enterprise business strategy, which of the following processes should be used to evaluate the existing information security controls as well as to select new information security controls?

    • AAccess control management
    • BChange management
    • CConfiguration management
    • DRisk management

    Show answer

    Answer: D

    Explanation

    Risk management is the process of identifying, assessing, and prioritizing risks to an organization, including the evaluation of existing controls and the selection of new controls based on changes in the business strategy. When the business strategy changes, it may introduce new risks or alter the significance of existing risks. Risk management allows organizations to adapt their information security controls to align with the evolving risk landscape. While access control management (option A), change management (option B), and configuration management (option C) are important processes within information security, risk management is the overarching process that guides the assessment of controls in the context of changing business strategies.

    Source: Adapted from community discussion — Viperhunter

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CISM practice, question 571. 1243 questions available.